Segurança

Minimize Claude token and cost waste across ALL surfaces — Claude Code subagents, API calls in code, and artifacts. Routes subagent model selection via the Agent tool's model parameter. Recommends /model switches when the current model is overkill or underpowered. Applies to any code importing anthropic or calling /v1/messages. Trigger on: "API call", "artifact", "pipeline", "multi-agent", "LangGr

Manage environment-variable hygiene and secrets safety across local development and production. Practical auditing, drift awareness, rotation readiness. Use when auditing .env files for committed secrets, planning a credential rotation, debugging missing-env-var production incidents, or hardening a new project against secrets leakage.

Persona de resposta a ameaças quânticas. Ativa-se ao discutir segurança pós-quântica, o limite de 1200 qubits, a vulnerabilidade secp256k1, condições de voo de dragão ou a transição de segredos armazenados para provas de variedades comportamentais.

SvelteKit & Svelte 5 Migration, Best-Practice Audit with state persistence. Use when: "sveltekit-audit", "sveltekit upgrade", "svelte migration", "svelte check", "sveltekit version", "svelte 5 runes".

/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS.

Use when adding, retiring, or auditing feature flags. Triggers on "add a flag", "ship behind a flag", "rollout plan", "kill switch", "stale flags", "flag debt", "LaunchDarkly", "GrowthBook", "Statsig", "Unleash", "Flipt", or any progressive-delivery question. Ships flag debt scanner, rollout planner, and kill-switch auditor (all stdlib Python), 4 references on flag taxonomy + provider trade-offs +

This skill helps Solidity developers, auditors or security researchers to find vulnerabilities inside a Solidity smart contract(s). The skill should be used when the user prompt is pointing to a specific codebase and seeking to find security issues or exploits inside the logic. The skill has its own checklists of different group with attack vectors to be verified on a codebase.

Codify security hardening into reusable Ansible roles — CrowdSec IDS, fail2ban, auditd, Tailscale VPN, Semaphore UI, scoped sudoers, systemd sandboxing, and UFW firewall management. Trigger on: "harden with Ansible", "Ansible security", "CrowdSec role", "fail2ban role", "auditd role", "Tailscale Ansible", "Semaphore role", "sudoers role", "security playbook", "fleet hardening", or any request to a

Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.

Audit and manage dependencies across multi-language projects. Identifies vulnerabilities, license conflicts, transitive dependency risks, and safe-upgrade paths. Use when auditing third-party packages before release, investigating a CVE, planning a major version bump, or running a license-compliance review.

Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.

Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enforces secure coding patterns, and automates compliance checks against SOC2, PCI-DSS, HIPAA, and GDPR. Use when conducting a security review